ISO 22000:2018Food safety management systems
ISO 22000 sets out how an organization in the food chain controls food safety hazards, so that food is safe when it is eaten. It places HACCP inside a management system and rests it on prerequisite programmes. FSSC 22000 is a separate certification scheme that takes ISO 22000 as its core and adds sector prerequisite programmes and further requirements. Which of the two you need depends on what your customers ask for.
New FSSC 22000 version: what changes for you
01At a glance
- Standard
- ISO 22000:2018
- Subject
- Food safety management systems
- Certificate
- Issued by AQC Group. Valid for three years, with a surveillance audit each year.
- Sectors
- Food industry
- Facts checked
- 9 October 2026, against iso.org
Who it is for
- Food and drink manufacturers and processors
- Animal feed and pet food producers
- Caterers, central kitchens and food service operators
- Cold stores, warehouses and food transport companies
- Makers of food packaging, ingredients and additives
- Retailers and wholesalers that handle food
02What you gain
What certification to ISO 22000 gives you
An answer for the customer who asked
Retailers, brand owners, caterers and export buyers often ask their suppliers for a certified food safety management system. A certificate to ISO 22000 shows that yours has been audited by an independent body.
Hazards dealt with in the process
A hazard analysis makes you write down what can go wrong at each step and how you stop it. Problems are caught on the line, before the product leaves, and less often in a complaint.
A recall you have practised
The standard asks for traceability and a tested withdrawal procedure. If a batch has to come back, you know where it went and who decides.
One system for the hygiene basics
Cleaning, pest control, supplier approval, training and monitoring records sit in one system with a named owner, so a gap is easier to see.
A base for FSSC 22000
If a customer later asks for a scheme recognized by the Global Food Safety Initiative (GFSI), the ISO 22000 system you already run is the core of FSSC 22000. You add the prerequisite programme standard for your sector and the scheme's additional requirements.
03What it asks of you
What ISO 22000 asks you to have in place
In plain terms and in our words, not the standard's. The standard itself is the authority, and you will need a copy.
Scope, leadership and a food safety policy
Decide which products, processes and sites the system covers. Top management sets a food safety policy and measurable objectives, provides the resources, and names a food safety team leader with the authority to act.
A food safety team and competent people
Appoint a team that between its members knows your products, processes, equipment and hazards. Show that people whose work affects food safety are trained and competent, including those who monitor control points and those who decide what happens to a suspect batch. Outside experts can help, but what they are responsible for must be written down.
Prerequisite programmes
These are the basic hygiene conditions that everything else rests on: the building and its layout, water, air and energy, cleaning and disinfection, pest control, personal hygiene, waste, storage, transport, supplier approval and the prevention of cross-contamination. You decide which apply, write down how each is done and check that it is done.
ISO 22000 asks you to consider the ISO 22002 series when you set these programmes. FSSC 22000 goes further and makes the part of that series written for your sector mandatory.
Traceability, withdrawal and emergencies
Be able to trace every lot one step back to its suppliers and one step forward to its first customers, and test that this works. Have a procedure for withdrawing or recalling product and practise it. Plan how you would respond to events that can affect food safety, such as a power cut, a flood or a contaminated water supply.
Hazard analysis
Describe your raw materials, ingredients, packaging and end products, and how the products are meant to be used. Draw flow diagrams and confirm them on site. For each step, identify the biological, chemical and physical hazards, allergens included, that can reasonably be expected, and assess how likely and how severe each is. Then choose control measures for the significant ones.
The hazard control plan
Each significant hazard is controlled either at a critical control point, with a measurable critical limit, or by an operational prerequisite programme, with an action criterion. For each one you set what is monitored, how often and by whom, and what is done to the product and to the process when the limit is missed. Before you rely on a control measure, you validate that it is able to control the hazard.
Verification and unsafe product
Plan checks that the system does what you said it would: review of monitoring records, product and environmental testing, calibration, internal audits. Product made while a critical limit was exceeded is not released. It is reprocessed, put to another use or destroyed. Product made while an operational prerequisite programme failed is held, and released only if the evidence shows it is safe.
Communication, review and improvement
Agree what you tell suppliers, customers and the authorities about food safety, and who tells them. Inside the organization, planned changes to products, ingredients, equipment or cleaning must reach the food safety team before they happen. Management reviews the system at planned intervals, and the team keeps the hazard analysis up to date.
04The audit
How certification to ISO 22000 works
Application and quotation
You tell us your scope, sites and headcount. We quote the audit days the standard's rules require.
Stage 1 audit
A review of your documented system and your readiness. You get a list of anything to settle before stage 2.
Stage 2 audit
The auditor follows your processes on site and samples records, to see that the system is in use and works.
Decision
Nonconformities are answered, the file is reviewed independently of the audit team, and AQC Group issues the certificate.
Surveillance and recertification
A shorter audit in each of the next two years, then a full recertification audit in the third.
What the auditor looks at
- The hazard analysis: whether it matches the real process, and whether the flow diagrams were confirmed on site
- Monitoring records for critical control points and operational prerequisite programmes, and what was done when a limit was missed
- Evidence that control measures were validated before they were relied on
- Prerequisite programmes in practice: cleaning, pest control, personal hygiene, allergen handling and the condition of the building
- A traceability test on a lot the auditor chooses, and the last withdrawal exercise
- The competence of the food safety team, internal audits and management review
What affects audit time
- The number of HACCP studies: each family of products or processes with its own hazard analysis adds audit time
- The number of people working within the scope, and the number of shifts and sites
- Your place in the food chain, since the starting audit time is set by the category of activity, such as manufacturing, catering or storage
- The scheme: FSSC 22000 sets its own audit duration rules in addition to those for ISO 22000
NewWhat is changing
FSSC 22000: from Version 6 to Version 7
ISO 22000 is still in its 2018 edition. The FSSC 22000 scheme has changed. Foundation FSSC released Version 7 on 1 May 2026 and gave organizations and certification bodies 12 months to prepare. Version 7 replaces the earlier prerequisite programme documents with the ISO 22002 series published in 2025 and updates the scheme's additional requirements.
The dates below are published by Foundation FSSC and apply only to FSSC 22000 certificates. The scheme is recognized by GFSI. When we checked on 9 October 2026, Foundation FSSC described the benchmarking of Version 7 with GFSI as still in progress. If you hold or plan an FSSC 22000 certificate, confirm the date of your own upgrade audit with your certification body.
- 1 May 2026
- Version 7 of the FSSC 22000 scheme released
- 30 April 2027
- Last day on which an audit against Version 6 may be delivered
- 1 May 2027 to 30 April 2028
- Upgrade audits against Version 7, carried out at the organization's next scheduled audit
05Often combined with
Standards audited alongside ISO 22000
Standards that share a structure can be audited together, in one visit and against one set of documents.
06Questions
Questions about ISO 22000
What is the difference between ISO 22000 and FSSC 22000?
ISO 22000 is an international standard for a food safety management system. FSSC 22000 is a certification scheme owned by Foundation FSSC. It takes ISO 22000 as its core and adds two things: the prerequisite programme standard for your sector from the ISO 22002 series, and the scheme's own additional requirements on subjects such as food defence, food fraud, allergen management, environmental monitoring and food safety culture.
FSSC 22000 is recognized by the Global Food Safety Initiative (GFSI). ISO 22000 on its own is not a GFSI-recognized scheme. An FSSC 22000 certificate is also kept under the scheme's rules, which include one unannounced audit every three years.
Which of the two do we need?
Ask the customer or the tender that is driving the request, and get the answer in writing. If they ask for a certified food safety management system or name ISO 22000, certification to ISO 22000 answers it. If they ask for a GFSI-recognized certificate, as many large retailers and international brand owners do, ISO 22000 alone will not satisfy them. You then need FSSC 22000 or another recognized scheme.
Only a certification body licensed by Foundation FSSC can certify to FSSC 22000. If you need FSSC 22000, ask us about its availability before you plan around it.
We already have HACCP. Is that the same thing?
No. HACCP is a method: you analyse hazards, set critical control points and limits, monitor them and act when a limit is missed. ISO 22000 is a management system that contains that method and surrounds it with what keeps it working: prerequisite programmes, a food safety team, validation of control measures, traceability, withdrawal, internal audits and management review.
A working HACCP plan is a good start. Expect to revisit the hazard analysis, because ISO 22000 asks you to sort control measures into critical control points and operational prerequisite programmes, and to validate them.
Does ISO 22000 apply to a company that does not make food?
Yes, if what you do can affect food safety. The standard is written for any organization in the food chain, whatever its size: feed producers, growers, manufacturers, caterers, retailers, transport and storage operators, and the suppliers of packaging, ingredients, additives, equipment and cleaning agents. The hazard analysis is scaled to what you actually do.
Is ISO 22000 being revised?
Yes. ISO lists a draft international standard, ISO/DIS 22000, that is intended to replace the 2018 edition. The draft went to ISO's national members for comment and vote in 2026, and further stages follow before publication. Until a new edition is published, audits and certificates are to ISO 22000:2018, read together with its 2024 amendment on climate change.
Which version of FSSC 22000 is current?
Version 7, released on 1 May 2026. Audits against Version 6 may still be delivered until 30 April 2027. Certified organizations move to Version 7 at an upgrade audit between 1 May 2027 and 30 April 2028. These dates come from Foundation FSSC.
Ask about ISO 22000 for your organization.
Tell us your scope, your sites and how many people work in them. We will tell you what the audit involves.